Method and system for detecting proxy internet access

ABSTRACT

A method for detecting proxy internet access includes intercepting an access request from a proxied terminal of a same internet account; and sending a redirection packet to the proxied terminal sending the access request. The redirection packet carries a first timestamp indicating when the redirection packet is sent. The method also includes receiving a reported timestamp difference between the first timestamp and a second timestamp. The second timestamp is a system time of the proxied terminal acquired after the proxied terminal receives the redirection packet. Further, the method includes executing a clustering process on the reported timestamp difference to obtain a clustering result; and based on the clustering result, detecting whether the same internet account is a proxy account.

CROSS-REFERENCES TO RELATED APPLICATIONS

This application claims priority of Chinese Patent Application No.201410572968.1, filed on Oct. 23, 2014, the entire contents of which arehereby incorporated by reference.

FIELD OF THE INVENTION

The present disclosure generally relates to the field of internettechnologies and, more particularly, relates to a method and system fordetecting proxy internet access.

BACKGROUND

With the development of internet technology, broadband internet accessbecomes a reality and demand for more and more users. However, differentfrom the independent broadband internet access, many users share theirown broadband internet access with others by routing equipment or proxysoftware. As a broadband internet account may be shared by a lot ofpeople through a proxy, the cost of broadband internet access may bedecreased, and even a profit may be made by the account holder. Thesharing of broadband internet access brings huge economic losses tonetwork operators.

The traditional methods for detecting proxy internet access generallyfall into two types: the first type is to determine whether a proxy isused according to the change of the connection number of a singleinternet account, or whether the connection number of a single internetaccount exceeds a certain threshold; and the second type is to detectproxy internet access by statistically finding the characteristics ofthe identities (ID) of internet protocol (IP) packets, and thecharacteristics of the sequence numbers of transmission controlprotocols (TCP). The first type of method for detecting proxy internetaccess relies on the rationality of threshold, but it may be difficultto determine a reasonable threshold. Proxy internet access could not bedetected by the second type of method if the router could support themodification of the ID information of IP packets and the serial numbersof TCP packets. Therefore, the accuracy of these two types of methodsfor detecting proxy internet access is low.

The disclosed methods and systems are directed to solve one or moreproblems set forth above and other problems in the art.

BRIEF SUMMARY OF THE DISCLOSURE

One aspect of the present disclosure includes a method for detectingproxy internet access. The method includes intercepting an accessrequest from a proxied terminal of a same internet account; and sendinga redirection packet to the proxied terminal sending the access request.The redirection packet carries a first timestamp indicating when theredirection packet is sent. The method also includes receiving areported timestamp difference between the first timestamp and a secondtimestamp. The second timestamp is a system time of the proxied terminalacquired after the proxied terminal receives the redirection packet.Further, the method includes executing a clustering process on thereported timestamp difference to obtain a clustering result; and basedon the clustering result, detecting whether the same internet account isa proxy account.

Another aspect of the present disclosure includes a system for detectingproxy internet access. The system includes an interception module, aredirection module, a receiving module, a processing module, and adetection module. The interception module is configured to intercept theaccess requests of a same internet account. The redirection module isconfigured to send a redirection packet to an access request, whereinthe redirection packet carries the first timestamp indicating when theredirection packet is sent. The receiving module is configured toreceive the reported timestamp difference between the first timestampand the second timestamp, wherein the second timestamp is the systemtime of the proxied terminal acquired after the proxied terminalreceives the redirection packet. The processing module is configured toexecute a clustering process on the reported timestamp differences toobtain a clustering result. The detection module is configured to, basedon the clustering result, determine whether the same internet account isa proxy access account.

Another aspect of the present disclosure includes a non-transitorycomputer-readable medium having computer program. When being executed bya processor, the computer program performs a method for detecting proxyinternet access. The method includes intercepting an access request froma proxied terminal of a same internet account; and sending a redirectionpacket to the proxied terminal sending the access request. Theredirection packet carries a first timestamp indicating when theredirection packet is sent. The method also includes receiving areported timestamp difference between the first timestamp and a secondtimestamp. The second timestamp is a system time of the proxied terminalacquired after the proxied terminal receives the redirection packet.Further, the method includes executing a clustering process on thereported timestamp difference to obtain a clustering result; and basedon the clustering result, detecting whether the same internet account isa proxy account.

Other aspects of the present disclosure can be understood by thoseskilled in the art in light of the description, the claims, and thedrawings of the present disclosure.

BRIEF DESCRIPTION OF THE DRAWINGS

The following drawings are merely examples for illustrative purposesaccording to various disclosed embodiments and are not intended to limitthe scope of the present disclosure.

FIG. 1 illustrates an exemplary application environment consistent withthe disclosed embodiments;

FIG. 2 illustrates a schematic flow chart of an exemplary method fordetecting proxy internet access consistent with the disclosedembodiments;

FIG. 3 illustrates a schematic flow chart of another exemplary methodfor detecting proxy internet access consistent with the disclosedembodiments;

FIG. 4 illustrates a schematic flow chart for obtaining a clusteringresult by executing a clustering process on the reported timestampdifference, consistent with the disclosed embodiments;

FIG. 5 illustrates a schematic chart of a clustering result consistentwith the disclosed embodiments;

FIG. 6 illustrates a schematic chart of exemplary time discretenessconsistent with the disclosed embodiments;

FIG. 7 illustrates a schematic screen shot of an exemplary interface forupdating the time setting of a proxied terminal consistent with thedisclosed embodiments;

FIG. 8 illustrates an exemplary system for detecting proxy internetaccess consistent with the disclosed embodiments;

FIG. 9 illustrates another exemplary system for detecting proxy internetaccess consistent with the disclosed embodiments;

FIG. 10 illustrates another exemplary system for detecting proxyinternet access consistent with the disclosed embodiments, and

FIG. 11 illustrates an exemplary computing system that may be used toimplement the proxy detection methods and systems consistent with thedisclosed embodiments.

DETAILED DESCRIPTION

To make the objectives, technical solutions and advantages of thepresent invention more clear and explicit, the present invention isdescribed in further detail with accompanying drawings and embodiments.It should be understood that the specific exemplary embodimentsdescribed herein are only for explaining the present invention and arenot intended to limit the present invention.

Reference will now be made in detail to exemplary embodiments of thedisclosure, which are illustrated in the accompanying drawings. Whereverpossible, the same reference numbers will be used throughout thedrawings to refer to the same or like parts.

FIG. 1 illustrates an exemplary application environment of a method anda system for detecting proxy internet access. As shown in FIG. 1, theapplication environment may include a proxied terminal 110 a, a proxiedterminal 110 b, a router 120, a proxy detection device 130, and a server140.

Although two proxied terminals 110 a and 110 b are shown in theapplication environment, there may be any number of proxied terminals,such as two or more proxied terminals. A proxied terminal 110 a or 110 bmay be a personal computer, a tablet, a smart phone, a personal digitalassistant, etc. In certain embodiments, the proxied terminal may also bea virtual terminal and multiple virtual proxied terminals may be runningfrom one or more physical terminals.

The router 120 may be a physical router or a virtual router, andmultiple virtual routers may be running from one or more physicalrouters. The proxy detection device 130 may be a physical proxydetection device or a virtual proxy detection device, and multiplevirtual proxy detection devices may be running from one or more physicalproxy detection devices. The server 140 may be a physical server or avirtual server, and multiple virtual servers may be running from one ormore physical servers.

FIG. 11 illustrates an exemplary computing system that may be used toimplement the proxy detection device 130. As shown in FIG. 11, thecomputing system may include a processor 910, a storage medium 920, amonitor 930, a communication module 940, a database 950, and peripherals960. Certain devices may be omitted and other devices may be included.

Processor 910 may include any appropriate processor or processors.Further, processor 910 can include multiple cores for multi-thread orparallel processing. Storage medium 920 may include memory modules, suchas ROM, RAM, flash memory modules, and erasable and rewritable memory,and mass storages, such as CD-ROM, U-disk, and hard disk, etc. Storagemedium 920 may store computer programs for implementing variousprocesses, when executed by processor 910.

Further, peripherals 960 may include I/O devices such as keyboard andmouse, and communication module 940 may include network devices forestablishing connections through the communication network. Database 950may include one or more databases for storing certain data and forperforming certain operations on the stored data, such as databasesearching.

The proxied terminals 110 a and the proxied terminal 110 b may initiatean access request to the server 140 via the router 120. The proxiedterminals 110 a and 110 b, both connected to the router 120, may accessthe server 140 via the same internet account. An access request may be,for example, a hypertext transfer protocol (HTTP) GET request.

The proxy detection device 130 is deployed between the server 140 andthe router 120, for intercepting access requests, redirecting accessrequests, and sending redirection packets to the proxied terminal 110 aor 110 b that initiates the access requests. The redirection packetincludes a preset script code, and the script code carries a firsttimestamp indicating the moment when the redirection packet is sent.Redirection refers to redirecting a variety of network requests to otherlocations, and an HTTP redirection refers to redirecting an originalHTTP request to another website. A script code refers to Javascript orthe like, a case-sensitive, dynamical-type, object-oriented andprototype-inheritance client script language that is evolved from theLiveScript of Netscape.

After receiving a redirection packet, the proxied terminal executes thescript code to obtain the system time of the proxied terminal, i.e. thesecond time stamp, and calculates the timestamp difference between thefirst timestamp and the second timestamp. The proxied terminal thenreports the timestamp difference to the proxy detection device 130through an access request (such as an HTTP GET request).

The proxy detection device 130 executes a clustering process on thetimestamp difference between the first timestamp and the secondtimestamp to obtain the clustering result of the timestamp difference,and determines whether the same internet account is a proxy internetaccount according to the clustering result.

Specifically, proxy internet access refers to the use of a router or aproxy tool so that multiple individuals or terminals may share aninternet IP address for internet access. For example, if a user usesASDL to access internet, a subnet can be established by connecting arouter under the ASDL modem, and the multiple terminals connected to theLAN port of the router may access internet by proxy through the router.

If an internet account has proxy internet access activities, thisinternet account is a proxy account. As the system time of each proxiedterminal is not totally same as that of others, after a period ofredirection, multiple difference classifications that are totallydifferent may be obtained. If an internet account only allows the use ofone proxied terminal, by detecting the presence of more than one proxiedterminals under the same internet account, proxy internet access can beconfirmed.

For example, in an internet account, the timestamp difference betweenthe first timestamp and the second timestamp of the proxy terminal A is−4, −4, −3, −4, −5, and the timestamp difference between the firsttimestamp and the second timestamp of the proxy terminal B is 20, 21,20, 19, 20, where the unit of timestamp difference is second. So thetimestamp difference of the proxied terminal A gathers at the center −4,and the timestamp difference of the proxied terminal B gathers at thecenter 20. According to the two different gathering centers or clusters,the presence of two proxied terminals of the same internet account canbe determined, i.e., proxy internet access activities are detected.

FIG. 2 illustrates a schematic flow chart of an exemplary method fordetecting proxy internet access. The method for detecting proxy internetaccess shown in FIG. 2 is operated in the application environment shownin FIG. 1, and is described from the aspect of the proxy detectiondevice. As shown in FIG. 2, the method for detecting proxy internetaccess comprises following steps.

Step 202: intercepting an access request from the same internet account.

Specifically, the proxy detection device intercepts an access requestfrom the same internet account. The access request may be an HTTP GETrequest. If there are more than one proxied terminals under the sameinternet account, these proxied terminals access internet through thesame internet account.

Step 204: sending a redirection packet to the proxied terminal sendingthe access request, where the redirection packet carries a firsttimestamp for the moment when the redirection packet is sent.Specifically, the redirection packet may include a preset script code.

Step 206: receiving the reported timestamp difference between the firsttimestamp and the second timestamp, where the second timestamp is thesystem time of the proxied terminal acquired after the proxied terminalreceives the redirection packet.

Specifically, after the proxied terminal initiating the access requestreceives a redirection packet, the proxied terminal executes the scriptcode in the redirected packet to obtain the system time of the proxiedterminal, i.e., the second time stamp. Then the proxied terminalcalculates the timestamp difference between the first time stamp and thesecond time stamp, and reports the calculated timestamp difference tothe proxy detection device.

Step 208: executing a clustering process on the reported timestampdifference to obtain a clustering result.

Specifically, the proxy detection device executes a clustering processto the reported timestamp difference, i.e., categorizes the reportedtimestamp difference, to determine the cluster which the reportedtimestamp difference belongs to.

Step 210: based on the clustering result, detecting whether the sameinternet account is a proxy account.

Specifically, after the reported timestamp difference is clustered, oneor more clusters can be obtained. Based on final number of clusters andthe maximum allowable number of proxied terminals of the same internetaccount, the proxy detection device may determine whether the internetaccount is a proxy account. If the number of clusters is larger than themaximum allowable number of proxied terminals, the internet account is aproxy account. If the number of clusters is less than or equal to themaximum allowable number of proxied terminals, the internet account isnot a proxy account. For example, if the number of clusters is 5, andthe maximum allowable number of proxied terminals of the internetaccount is 4, it can be determined that the internet account has proxyinternet access activities, and the internet account is a proxy account.

In the method for detecting proxy internet access, the proxy detectiondevice intercepts the access requests of the same internet account,sends redirection packets which carry the first timestamp, and receivesthe timestamp differences between the first timestamp and the secondtime stamp acquired after the proxied terminal receives the redirectionpackets. By executing clustering process to the timestamp differences,the proxy detection device can, based on the clustering results,determine whether the same internet account is a proxy account.

By categorizing the timestamp differences between the timestamp ofsending the redirection packet and the timestamp after the proxiedterminal receives the redirection packet, the disclosed method fordetecting proxy internet access may avoid the detection error due to thechanges of the ID information of the IP packet and the serial numberinformation of the TCP packet, and thus the detection accuracy isincreased.

In certain embodiments, the Step 202 and Step 204 may be executed at onestage, and the Steps 206, 208 and 210 may be executed at a later stage.

FIG. 3 illustrates a flow chart of another exemplary method fordetecting proxy internet access. As shown in FIG. 3, the method fordetecting proxy internet access includes following steps.

Step 302: intercepting an access request from the same internet account.

Step 304: determining whether the access request is a response to aredirection packet. If the access request is a response to a redirectionpacket, the process goes to Step 310. If the access request is not aresponse to a redirection packet, the process goes to Step 306.

Specifically, to determine whether an access request is a response to aredirection packet, the proxy detection device first checks whether thetarget IP address of the access request is a proxy detection device,and/or whether the proxied terminal communicates with a specific port(such as port 89 etc.) of a proxy detection device. The proxy detectiondevice further checks whether the access request contains a specificstring of response data of the proxy detection device, such as“GET/info? ip=### & interval=###” and so on. If the access requestcontains a specific string of response data of the proxy detectiondevice, the access request is a response to a redirection packet.

Step 306: determining whether the time interval between the presentaccess request and the last redirection packet exceeds a preset timeinterval, i.e., the time between receiving the present access requestand sending the last redirection packet. If the time interval betweenthe present access request and the last redirection packet exceeds thepreset time interval, the process goes to Step 308. If the time intervalbetween the present access request and the last redirection packet doesnot exceed the preset time interval, the process ends.

Specifically, the preset time interval is the time interval forredirection, and it may be set according to actual needs. For example,if the preset time interval is one minute, redirection happens every oneminute. The purpose of setting a preset time interval is to prevent acycle or a loop of redirection so as to avoid impact on users' access tothe network. For example, when the proxied terminal A visitswww.abc.com, after the access request is redirected, the redirectedscript code may refresh the access request of the proxied terminal A towww.abc.com. If there is no preset time interval, for an HTTP GETrequest, when the script code refreshes the access request of the proxyterminal A to www.abc.com, the access request may be redirected again,leading to the cycle of redirection, and as a result, the webpage couldnot be opened.

The preset time interval T may be adjusted according to actual needs.The smaller the value of T, the greater the impact on users' access tothe network, and the faster the speed of proxy internet accessdetection. The greater the value of T, the smaller the impact on users'access to the network, and the slower the speed of proxy internet accessdetection.

Step 308: sending a redirection packet to the access request, where theredirection packet carries the first timestamp for the moment when theredirection packet is sent.

Step 310: receiving the timestamp difference between the reported firsttimestamp and the second timestamp, where the second timestamp is thesystem time of the proxied terminal acquired after the proxied terminalreceives the redirect packet and executes the script code.

Specifically, if the access request is a response to a redirectionpacket, the proxy detection device obtains the timestamp differencebetween the reported first timestamp and the second timestamp from theresponse, where the second timestamp is the system time of the proxiedterminal acquired after the proxied terminal receives the redirectpacket and executes the script code.

Step 312: executing a clustering process to the reported timestampdifference to obtain a clustering result.

Specifically, the clustering process on the reported timestampdifference is categorizing the timestamp difference to determine whichcluster the timestamp difference belongs to.

Step 314: based on the clustering result, determining whether the sameinternet account is a proxy account.

In the disclosed method for detecting proxy internet access, the proxydetection device intercepts an access request of the same internetaccount, determines whether the access request is a response to aredirection packet. If the access request is a response to a redirectionpacket, the proxy detection device extracts the timestamp differencefrom the response. If the access request is not a response to aredirection packet, the system determines whether the data intervalbetween the current access request and the last redirection packetexceeds a preset time interval.

If the data interval exceeds a preset time interval, the proxy detectiondevice sends the redirection packet that carries the first timestamp,and receives the timestamp difference between the first timestamp andthe second timestamp acquired after the proxied terminal receives theredirection packet. The proxy detection device then executes aclustering process to the timestamp difference. According to theclustering result, the proxy detection device may determine whether thesame internet account is a proxy access account.

By categorizing the timestamp difference between the timestamp ofsending a redirection packet and the timestamp after the proxiedterminal receives the redirection packet, the detection error due to thechanges of the ID information of the IP packet and the serial numberinformation of the TCP packet may be avoided, and the detection accuracyis thus improved. Further, by analyzing the time interval between theaccess request and sending the last redirection packet, the impact onusers' internet access may be reduced.

FIG. 4 illustrates a schematic flow chart for obtaining a clusteringresult by executing a clustering process on the reported timestampdifference. As shown in FIG. 4, obtaining a clustering result byexecuting a clustering process on the reported timestamp differenceincludes following steps.

Step 402: determining whether the reported timestamp difference isreported for the first time. If the reported timestamp difference isreported for the first time, the process goes to Step 414. If thereported timestamp difference is not reported for the first time, theprocess goes to Step 404.

Step 404: calculating the shortest distance between the reportedtimestamp difference and the existing cluster centers.

Specifically, if there are multiple cluster centers, the proxy detectiondevice calculates the distance of the reported timestamp difference toeach cluster center, and then chooses the shortest distance.

Step 406: determining whether the shortest distance is larger than orequal to a predetermined threshold. If the shortest distance is largerthan or equal to the threshold, the process goes to Step 414. If theshortest distance is less than the threshold, the process goes to Step408.

Specifically, the value of the threshold may be set depending on thepractical circumstances, for example, 3, 4 seconds and so on.

Step 408: updating the cluster center of the shortest distance and thenumber of the times when the cluster is hit by reported timestampdifferences.

Specifically, the way for updating the cluster center of the shortestdistance may be taking the average value of all the timestampdifferences of the cluster as the new cluster center, or taking theaverage value of the timestamp differences excluding the minimum andmaximum timestamp difference values, as the new cluster center.

The steps for counting the number of times ‘A’ when a cluster is hit byreported timestamp differences and calculating the accumulated reportedtimestamp difference ‘B’, and updating the cluster center include:adding the present reported timestamp difference to the accumulatedtimestamp difference to get the new accumulated timestamp difference;increasing the number of hits by one (1) to get the new number of hits;and obtaining the new cluster center by dividing the new accumulatedtimestamp difference with the new number of hits.

Step 410: determining whether the number of hits is larger than or equalto a threshold. If the number of hits is larger than or equal to thethreshold, the process goes to Step 412. If the number of hits is lessthan a threshold, the process ends.

If the number of hits of a cluster is larger than or equal to athreshold, the cluster represents an effective proxied terminal, and thenumber of proxied terminals under the same internet account increases byone (1). If the number of hits of a cluster is less than the threshold,the number of proxied terminals under the same internet account remainsunchanged.

Step 412: the cluster represents an effective proxy terminal, and thenumber of proxied terminals under the same internet account increases byone (1).

Step 414: generating a new cluster, with the cluster center of the newcluster being the reported timestamp difference.

Thus, the above clustering process only requires simple calculations,and the clustering efficiency of the clustering process is substantiallyhigh.

FIG. 5 illustrates a schematic chart of a clustering result. In FIG. 5,the clustering is explained with the proxied terminal A and the proxiedterminal B as examples. A proxy detection device receives an HTTP GETrequest from the proxied terminal A, detects the time interval whichsatisfies the redirection requirement, and sends an HTTP redirectionpacket, where the redirection packet includes the first timestamp Td1for the moment when the proxy detection device sends the redirectionpacket.

After receiving the redirection packet, the proxied terminal A acquiresthe system time of the proxied terminal A, i.e., the second timestampTa, and then calculates the timestamp difference between the firsttimestamp Tdl and the second timestamp Ta. The proxied terminal Afurther uses the HTTP GET request that carries the timestamp differenceto report the timestamp difference to the proxy detection device. Theproxy detection device then categorizes the reported timestampdifference according to the proxied terminal A corresponding to theinternet account. The proxied terminal B executes the same procedure.

After a period of redirection, following results may be obtained: thetimestamp differences reported by the proxied terminal A are −4, −4, −3,−4, −5, . . . , and the timestamp differences reported by the proxiedterminal B are 20, 21, 20, 19, 20, . . . . The reported timestampdifferences from each proxied terminal fall into a small error range.Based on the clustering processing, the close timestamp differences areclustered together, and the faraway timestamp differences are classifiedinto different categories corresponding to different proxied terminals.For example, the timestamp differences from the proxied terminal A aregathered within a certain radius, and the timestamp differences from theproxied terminal B are gathered in another radius.

In an exemplary embodiment, to ensure the detection effect, the methodfor detecting proxy access includes following three steps.

First, getting a preset maximum allowable number of proxied terminalsunder the same internet account.

Second, based on the maximum allowable number of proxied terminals,obtaining the required number of discrete time and the predeterminedsequence of the required number of discrete time.

For example, if the maximum allowable number of proxied terminals isfour (4), the required number of the discrete time is five (5). Thepredetermined sequence of the required number of the discrete time maybe +24 seconds, −24 seconds, +12 seconds, −12 seconds and 0 seconds. Asshown in FIG. 6, the discrete time values are +24 seconds, −24 seconds,+12 seconds, −12 seconds, and 0 seconds.

Third, upon detecting the automatic update of the system time of eachproxied terminal under the same internet account, according to thesequence of the required number of discrete time, sequentially executinga uniform discretization process on the system time of each proxiedterminal.

FIG. 7 illustrates a schematic chart of an exemplary interface forupdating the time setting of a proxied terminal. As shown in FIG. 7, aproxied terminal may automatically synchronize with the time server ofinternet, and automatically update the time of the proxied terminal.

Upon detecting that proxied terminals update the time of the proxiedterminals, the proxy detection device adds +24 seconds to the firstupdate of time of the same internet account, i.e. 24 seconds faster thanthe standard time, adds −24 seconds to the second update of time, i.e.24 seconds slower than the standard time, adds +12 seconds to the thirdupdate of time, adds −12 seconds to the fourth update of time, and adds0 seconds to the fifth update time, and so on. By such a discretizationprocess, the time of each proxied terminal is different from each otheras far as possible. After such a discretization process, the subsequentclustering process may become easier, and more proxy access may bedetected.

FIG. 8 illustrates a structural block diagram of an exemplary system fordetecting proxy internet access. As shown in FIG. 8, the system fordetecting proxy internet access comprises an interception module 810, aredirection module 820, a receiving module 830, a processing module 840,and a detection module 850.

The interception module 810 is configured to intercept the accessrequests of the same internet account. The redirection module 820 isconfigured to send a redirection packet to an access request, where theredirection packet carries the first timestamp of the moment when theredirection packet is sent. The redirection packet includes a presetscript code.

The receiving module 830 is configured to receive the reported timestampdifference between the first timestamp and the second timestamp, wherethe second timestamp is the system time of the proxied terminal acquiredafter the proxied terminal receives the redirection packet. Afterreceiving a redirection packet, the proxied terminal executes the scriptcode to get the system time of the proxied terminal, and calculates thedifference between the first timestamp and the system time.

The processing module 840 is configured to execute a clustering processto the reported timestamp differences to obtain a clustering result.

In the present exemplary embodiment, the processing module 840 is alsoconfigured to determine whether a reported timestamp difference isreported for the first time. If the reported timestamp difference isreported for the first time, the processing module generates a newcluster, with the cluster center of the new cluster being the reportedtimestamp difference. If the reported timestamp difference is notreported for the first time, the processing module calculates theshortest distance between the reported timestamp difference and theexisting cluster center, and determines whether the shortest distance islarger than or equal to a distance threshold.

If the shortest distance is larger than or equal to the distancethreshold, the processing module generates a new cluster, with thecluster center of the new cluster being the reported timestampdifference. If the shortest distance is less than the distancethreshold, the processing module updates the cluster center of theshortest distance, and updates the number of hits on the cluster byreported timestamp differences, and determines whether the updatednumber of hits is larger than or equal to a number threshold.

If the updated number of hits is larger than or equal to the numberthreshold, the cluster is represented as an effective proxied terminal,and the number of proxied terminals under the same internet accountincreases by one (1). If the number of hits is less than the numberthreshold, the number of proxied terminals under the same internetaccount remains unchanged.

Specifically, if there are more than one cluster centers, the processingmodule calculates the distance of the reported timestamp difference toeach cluster center, and then chooses the shortest distance.

The detection module 850 is configured to, based on the clusteringresult, determine whether the same internet account is a proxy accessaccount.

In the method for detecting proxy internet access, the system fordetecting proxy internet access intercepts the access requests of thesame internet account, sends redirection packets which carry the firsttime stamp, and receives the timestamp differences between the firsttimestamp and the second timestamp acquired after the proxied terminalreceives the redirection packets. By executing clustering process on thetimestamp differences, the system for detecting proxy internet accesscan, based on the clustering results, determine whether the sameinternet account is a proxy account.

By categorizing the timestamp difference between the timestamp ofsending the redirection packet and the timestamp after the proxiedterminal receives the redirection packet, the disclosed method fordetecting proxy internet access may avoid the detection error due to thechanges of the ID information of the IP packet and the serial numberinformation of the TCP packet, and thus the detection accuracy isincreased.

FIG. 9 illustrates another exemplary system for detecting proxy internetaccess. As shown in FIG. 9, the system for detecting proxy internetaccess comprises an interception module 810, a redirection module 820, areceiving module 830, a processing module 840 and a detection module850, and the system further comprises a determination module 860 andextraction module 870.

The determination module 860 is configured to, after intercepting anaccess request of the same internet account, determine whether theaccess request is a response to a redirection packet. If the accessrequest is not a response to a redirection packet, the determinationmodule 860 further determines whether the data interval between thepresent access request and the last redirection packet exceeds a presettime interval.

The extraction module 870 is configured to, when the access request isdetermined be a response to a redirection packet, obtain the timestampdifference between the first timestamp and the second timestamp from theresponse.

The redirection module 820 is also configured to, when the data intervalbetween the present access request and the last redirection packetexceeds a preset time interval, send a redirection packet to the accessrequest. The redirection packet carries the first timestamp of themoment when the redirection packet is sent.

FIG. 10 illustrates another exemplary system for detecting proxyinternet access. As shown in FIG. 10, the system for detecting proxyinternet access comprises an interception module 810, a redirectionmodule 820, a receiving module 830, a processing module 840 anddetection module 850, and the system further comprises an acquisitionmodule 880 and a discretization module 890.

The acquisition module 880 is configured to acquire the preset maximumallowable number of proxied terminals under the same internet account,as well as to obtain the required number of discrete time based on themaximum allowable number of proxied terminals, and further to obtain thepredetermined sequence of the required number of discrete time.

For example, if the maximum allowable number of proxied terminals isfour (4), the required number of the discrete time is five (5). Thepredetermined sequence of the required number of the discrete time maybe +24 seconds, −24 seconds, +12 seconds, −12 seconds and 0 seconds. Asshown in FIG. 6, the discrete time values are +24 seconds, −24 seconds,+12 seconds, −12 seconds, and 0 seconds.

The discretization module 890 is configured to, upon detecting theautomatic update of the system time of each proxied terminal under thesame internet account, according to the sequence of the required numberof discrete time, sequentially execute a uniform discretization processon the system time of each proxied terminal.

Upon detecting that proxied terminals update the time of the proxiedterminals, the discretization module 890 adds +24 seconds to the firstupdate of time of the same internet account, i.e. 24 seconds faster thanthe standard time, adds −24 seconds to the second update of time, i.e.24 seconds slower than the standard time, adds +12 seconds to the thirdupdate of time, adds −12 seconds to the fourth update of time, and adds0 seconds to the fifth update time, and so on. By such a discretizationprocess, the time of each proxied terminal is different from each otheras far as possible. After such a discretization process, the subsequentclustering process may become easier, and more proxy access may bedetected.

In certain exemplary embodiments, the system for detecting proxyinternet access may comprises an intercepting module 810, a redirectionmodule 820, a receiving module 830, a processing module 840, a detectionmodule 850, a determination module 860, an extraction module 870, anacquisition module 880, and a discretization module 890.

The ordinary technical staff in this area may understand that all orpart of the processes of the above-described embodiments of the method,may be achieved through instructing relevant hardware by a computerprogram. The program may be stored in a computer readable storagemedium. By executing the program, processes of the above-describedexemplary embodiments can be implemented. The storage medium may be amagnetic disk, an optical disk, a read-only memory (ROM), or a randomaccess memory (RAM), and so on.

The embodiments disclosed herein are exemplary only and not limiting thescope of this disclosure. Various alternations, modifications, orequivalents to the technical solutions of the disclosed embodiments canbe obvious to those skilled in the art and can be included in thisdisclosure. Without departing from the spirit and scope of thisinvention, such other modifications, equivalents, or improvements to thedisclosed embodiments are intended to be encompassed within the scope ofthe present disclosure.

What is claimed is:
 1. A method for detecting proxy internet access,comprising: intercepting an access request from a proxied terminal of asame internet account; sending a redirection packet to the proxiedterminal sending the access request, wherein the redirection packetcarries a first timestamp indicating when the redirection packet issent; receiving a reported timestamp difference between the firsttimestamp and a second timestamp, wherein the second timestamp is asystem time of the proxied terminal acquired after the proxied terminalreceives the redirection packet; executing a clustering process on thereported timestamp difference to obtain a clustering result; and basedon the clustering result, detecting whether the same internet account isa proxy account.
 2. The method for detecting proxy internet accessaccording to claim 1, wherein executing a clustering process on thereported timestamp difference to obtain a clustering result furtherincludes: determining whether the reported timestamp difference isreported for a first time; and when the reported timestamp difference isreported for the first time, generating a new cluster, with a clustercenter of the new cluster being the reported timestamp difference. 3.The method for detecting proxy internet access according to claim 2,further including: when the reported timestamp difference is notreported for the first time, calculating a shortest distance between thereported timestamp difference and an existing cluster center;determining whether the shortest distance is larger than or equal to adistance threshold; and when the shortest distance is larger than orequal to the distance threshold, generating the new cluster, with thecluster center of the new cluster being the reported timestampdifference.
 4. The method for detecting proxy internet access accordingto claim 3, further including: when the shortest distance is less than adistance threshold, updating the cluster center of the shortestdistance, and updating a number of hits on the cluster by reportedtimestamp differences; determining whether the updated number of hits islarger than or equal to a number threshold; when the updated number ofhits is larger than or equal to the number threshold, determining thecluster as an effective proxied terminal, and increasing a number ofproxied terminals under the same internet account by one (1); and whenthe number of hits is less than the number threshold, keeping the numberof proxied terminals under the same internet account unchanged.
 5. Themethod for detecting proxy internet access according to claim 1, furtherincluding: getting a preset maximum allowable number of proxiedterminals under the same internet account; based on the maximumallowable number of proxied terminals, obtaining a required number ofdiscrete time and a predetermined sequence of the required number ofdiscrete time; and upon detecting an automatic update of the system timeof each proxied terminal under the same internet account, according tothe sequence of the required number of discrete time, sequentiallyexecuting a uniform discretization process on the system time of eachproxied terminal.
 6. The method for detecting proxy internet accessaccording to claim 1, after intercepting an access request from the sameinternet account, further including: determining whether the accessrequest is a response to a redirection packet; when the access requestis a response to a redirection packet, receiving the timestampdifference between the reported first timestamp and the secondtimestamp; and when the access request is not a response to aredirection packet, determining whether a time interval between apresent access request and a last redirection packet exceeds a presettime threshold.
 7. The method for detecting proxy internet accessaccording to claim 6, further including: when the time interval betweenthe present access request and the last redirection packet exceeds thepreset time threshold, sending a redirection packet to the proxiedterminal sending the access request; and when the time interval betweenthe present access request and the sending of last redirection packetdoes not exceed the preset time threshold, not sending any redirectionpacket to the proxied terminal sending the access request.
 8. The methodfor detecting proxy internet access according to claim 1, wherein theredirection packet includes a preset script code; after receiving aredirection packet, the proxied terminal executes the script code to getthe system time of the proxied terminal, and calculates a differencebetween the first timestamp and the system time.
 9. A system fordetecting proxy internet access, comprising: an interception moduleconfigured to intercept the access requests of a same internet account;a redirection module configured to send a redirection packet to anaccess request, wherein the redirection packet carries the firsttimestamp indicating when the redirection packet is sent; a receivingmodule configured to receive the reported timestamp difference betweenthe first timestamp and the second timestamp, wherein the secondtimestamp is the system time of the proxied terminal acquired after theproxied terminal receives the redirection packet; a processing moduleconfigured to execute a clustering process on the reported timestampdifferences to obtain a clustering result; and a detection moduleconfigured to, based on the clustering result, determine whether thesame internet account is a proxy access account.
 10. The system fordetecting proxy internet access according to claim 9, wherein: theprocessing module is also configured to determine whether a reportedtimestamp difference is reported for a first time; when the reportedtimestamp difference is reported for the first time, the processingmodule generates a new cluster, with the cluster center of the newcluster being the reported timestamp difference; when the reportedtimestamp difference is not reported for the first time, the processingmodule calculates the shortest distance between the reported timestampdifference and the existing cluster center, and determines whether theshortest distance is larger than or equal to a distance threshold; whenthe shortest distance is larger than or equal to the distance threshold,the processing module generates a new cluster, with the cluster centerof the new cluster being the reported timestamp difference; when theshortest distance is less than the distance threshold, the processingmodule updates the cluster center of the shortest distance, and updatesthe number of hits on the cluster by reported timestamp differences, anddetermines whether the updated number of hits is larger than or equal toa number threshold; and when the updated number of hits is larger thanor equal to the number threshold, the cluster is represented as aneffective proxied terminal, and the number of proxied terminals underthe same internet account increases by one (1); when the number of hitsis less than the number threshold, the number of proxied terminals underthe same internet account remains unchanged.
 11. The system fordetecting proxy internet access according to claim 9, further including:an acquisition module configured to acquire a preset maximum allowablenumber of proxied terminals under the same internet account, as well asto obtain a required number of discrete time based on the maximumallowable number of proxied terminals, and further to obtain apredetermined sequence of the required number of discrete time; and adiscretization module configured to, upon detecting an automatic updateof the system time of each proxied terminal under the same internetaccount, according to the sequence of the required number of discretetime, sequentially execute a uniform discretization process on thesystem time of each proxied terminal.
 12. The system for detecting proxyinternet access according to claim 9, further including: a determinationmodule configured to, after intercepting an access request of the sameinternet account, determine whether the access request is a response toa redirection packet, and when the access request is determined to benot a response to a redirection packet, further determine whether thedata interval between the present access request and the lastredirection packet exceeds a preset time interval; an extraction moduleconfigured to, when the access request is determined to be a response toa redirection packet, obtain the timestamp difference between the firsttimestamp and the second timestamp from the response; and a redirectionmodule also configured to, when the data interval between the presentaccess request and the last redirection packet exceeds a preset timeinterval, send a redirection packet to the access request, where theredirection packet carries the first timestamp of the moment when theredirection packet is sent.
 13. The system for detecting proxy internetaccess according to claim 9, where the redirection packet includes apreset script code, and the proxied terminal, after receiving aredirection packet, executes the script code to get the system time ofthe proxied terminal, and calculates the difference between the firsttimestamp and the system time.
 14. A non-transitory computer-readablemedium having computer program for, when being executed by a processor,performing a method for detecting proxy internet access, the methodcomprising: intercepting an access request from a proxied terminal of asame internet account; sending a redirection packet to the proxiedterminal sending the access request, wherein the redirection packetcarries a first timestamp indicating when the redirection packet issent; receiving a reported timestamp difference between the firsttimestamp and a second timestamp, wherein the second timestamp is asystem time of the proxied terminal acquired after the proxied terminalreceives the redirection packet; executing a clustering process on thereported timestamp difference to obtain a clustering result; and basedon the clustering result, detecting whether the same internet account isa proxy account.
 15. The non-transitory computer-readable mediumaccording to claim 14, wherein executing a clustering process on thereported timestamp difference to obtain a clustering result furtherincludes: determining whether the reported timestamp difference isreported for a first time; and when the reported timestamp difference isreported for the first time, generating a new cluster, with a clustercenter of the new cluster being the reported timestamp difference. 16.The non-transitory computer-readable medium according to claim 15, themethod further including: when the reported timestamp difference is notreported for the first time, calculating a shortest distance between thereported timestamp difference and an existing cluster center;determining whether the shortest distance is larger than or equal to adistance threshold; and when the shortest distance is larger than orequal to the distance threshold, generating the new cluster, with thecluster center of the new cluster being the reported timestampdifference.
 17. The non-transitory computer-readable medium according toclaim 16, the method further including: when the shortest distance isless than a distance threshold, updating the cluster center of theshortest distance, and updating a number of hits on the cluster byreported timestamp differences; determining whether the updated numberof hits is larger than or equal to a number threshold; when the updatednumber of hits is larger than or equal to the number threshold,determining the cluster as an effective proxied terminal, and increasinga number of proxied terminals under the same internet account by one(1); and when the number of hits is less than the number threshold,keeping the number of proxied terminals under the same internet accountunchanged.
 18. The non-transitory computer-readable medium according toclaim 14, the method further including: getting a preset maximumallowable number of proxied terminals under the same internet account;based on the maximum allowable number of proxied terminals, obtaining arequired number of discrete time and a predetermined sequence of therequired number of discrete time; and upon detecting an automatic updateof the system time of each proxied terminal under the same internetaccount, according to the sequence of the required number of discretetime, sequentially executing a uniform discretization process on thesystem time of each proxied terminal.
 19. The non-transitorycomputer-readable medium according to claim 14, after intercepting anaccess request from the same internet account, the method furtherincluding: determining whether the access request is a response to aredirection packet; when the access request is a response to aredirection packet, receiving the timestamp difference between thereported first timestamp and the second timestamp; and when the accessrequest is not a response to a redirection packet, determining whether atime interval between a present access request and a last redirectionpacket exceeds a preset time threshold.
 20. The non-transitorycomputer-readable medium according to claim 19, the method furtherincluding: when the time interval between the present access request andthe last redirection packet exceeds the preset time threshold, sending aredirection packet to the proxied terminal sending the access request;and when the time interval between the present access request and thesending of last redirection packet does not exceed the preset timethreshold, not sending any redirection packet to the proxied terminalsending the access request.